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This paper proposes a mathematical definition of an aircraft-separation criterion for 
kinematic-based horizontal maneuvers. It has been formally proved that kinematic maneu- 
vers that satisfy the new criterion are independent and coordinated for repulsiveness, i.e., 
the distance at closest point of approach increases whether one or both aircraft maneuver 
according to the criterion. The proposed criterion is currently used in NASA’s Airborne 
Coordinated Resolution and Detection (ACCoRD) set of tools for the design and analysis 
of separation assurance systems. 


Nomenclature 


D Minimum horizontal separation 

e Directionality parameter whose value is ±1 

s Two-dimensional aircraft position 

t Time variable 

T Time step 

u, w Two-dimensional vector variables 

V Two-dimensional aircraft velocity 

V Kinematic maneuver 


Subscripts 

0 Ownship information of a position or velocity vector 

1 Intruder information of a position or velocity vector 

X Northern component of a position or velocity vector 

y Eastern component of a position or velocity vector 


I. Introduction 

Maintaining aircraft separation is a safety objective of air traffic management systems. A credible demon- 
stration that this goal has been achieved for a given airspace concept is challenging due to many inherent 
characteristics of these concepts. In particular, advanced airspace concepts often involve safety-critical dis- 
tributed software that interacts with human actors [9] . The standard method of demonstrating the viability 
of an advanced airspace concept is through high fidelity simulations of relevant scenarios. However, no mat- 
ter how many scenarios are examined, this approach can never demonstrate that the safety-critical software, 
on which the concept is based, keeps aircraft separated in all scenarios, including those that are off-nominal. 
Given the paramount importance of safety, an approach that can give strong assurances for the safe behavior 
of new air traffic management systems is necessary when developing such systems. 

In previous work by the authors [4], an analytical and formal approach for verifying the safe interplay 
between (possibly different) separation assurance algorithms was proposed. This approach relies on the 
definitions of analytical formulas, called criteria, that characterize sets of resolution maneuvers that are both 
independent, i.e., separation is ensured when only one aircraft maneuvers, and coordinated, i.e., separation 
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is ensured when two conflicting aircraft both maneuver. A criterion in this context is a formal condition 
that a proposed maneuver for an aircraft can satisfy. In a conflict scenario between two aircraft, if the 
resolution maneuvers of the aircraft each satisfy an appropriate criterion, it can be guaranteed that the 
aircraft resolve the conflict even if they simultaneously maneuver. It has been formally proved that for 
state-based (instantaneous) maneuvers, the given criteria provide sufficient conditions for independence and 
coordination [5]. Hence, resolution algorithms that compute state-based maneuvers that satisfy the criteria 
inherit independence and coordination properties regardless of how these maneuvers are computed. 

The criteria presented by the authors in previous work can be used to show safe interplay between 
algorithms that give instantaneous maneuvers to the pilot. These state-based maneuvers are often computed 
by tactical conflict-resolution algorithms [3] for time to conflict that ranges between 5 and 20 minutes. For 
these times, trajectory prediction errors introduced by the instantaneous-maneuver assumption of state- 
based algorithms are considered acceptable. However, for short time intervals, such as in the case of collision 
avoidance systems [7] or loss of separation recovery algorithms [1], the instantaneous-maneuver assumption 
may produce infeasible or incorrect resolutions. 

This paper extends the work in [5] by studying a criterion that does not assume instantaneous maneuvers. 
Indeed, the proposed criterion applies to kinematic-based horizontal maneuvers. The result is a mathematical 
criterion for kinematic maneuvers that guarantees independence and coordination. This coordination is 
implicit in the sense that no communication is assumed between the aircraft other than knowledge of the 
other aircraft’s initial position and velocity before the maneuver. The proposed criterion is currently used in 
NASA’s Airborne Coordinated Resolution and Detection (ACCoRD)®' set of tools for the design and safety 
analysis of separation assurance systems. 

The theorems in this paper have been formally proved in the Prototype Verification System (PVS) [6]. 
PVS is a system for verifying mathematical statements. In particular, PVS allows safety properties, such 
as independence and coordination, to be stated and formally proved. Once a safety property is specihed in 
PVS, it is up to the user to prove in PVS that the condition holds. PVS has a reasoning engine that encodes 
mathematical logic, so only statements that are mathematically correct can be proved in PVS. The use of a 
system like PVS for proving safety properties about separation assurance systems in the airspace is justified 
by the importance of safety and the key part that these systems play in the overall safety of the airspace. 

The rest of this paper is structured as follows. Section II gives a brief overview of the criteria-based 
resolution approach. Section HI reviews coordination for instantaneous maneuvers, Section IV presents a 
criterion for kinematic maneuvers and its main properties. Section V provides a counterexample that shows 
that even trajectories that are incrementally diverging from one another do not always exhibit coordination, 
and Section VI concludes the paper. 

II. Criteria-Based Resolution Approach 

Formally, a criterion is specified as an analytical formula that dehnes a set of acceptable resolution 
maneuvers for an aircraft in a conflict scenario. As a simple example, a criterion specihcally for aircraft in a 
head-on conflict might state that each aircraft must alter course to the right, as stated in part 91.113 of the 
Federal Aviation Regulations [2]. 

In general, criteria for instantaneous maneuvers can be analytically expressed by formulas involving the 
positions and velocity vectors of two aircraft, referred to as the ownship and the intruder, and a parameter 
that indicates directionality of the set of maneuvers, e.g., left/right, up/down, etc. For instance, a criterion 
for horizontal conflict avoidance was presented in [5]. That criterion specifies a mathematical condition on 
resolution maneuvers that are guaranteed to be independent, i.e., the maneuvers avoid the conflict assuming 
that only the ownship maneuvers, and coordinated, i.e., they also avoid the conflict if both aircraft simultane- 
ously maneuver according to the criterion. The parameter indicating directionality for this criterion is called 
e, which takes a value of either —1 or 1. If both aircraft maneuver, then they must select resolutions using 
the same e value, which can be chosen implicitly from the input states of the aircraft. This is illustrated 
in Figure 1. The current ownship velocity vector is shown in blue and the current traffic velocity vector is 
shown in magenta. Conflict Detection and Resolution (CD&R) systems that for both aircraft select reso- 
lution vectors anywhere in their green regions will produce resolution maneuvers that are always implicitly 
coordinated. Conversely, if the CD&R systems on both aircraft select resolution vectors anywhere in their 
blue regions, the combined result will be implicitly coordinated. If only one aircraft maneuvers, then a vector 
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Figure 1. Visualization of Horizontal Criterion for Conflict Avoidance 


in either the blue or green region will suffice. 

The criterion for kinematic maneuvers proposed in this paper builds upon another criterion for instanta- 
neous maneuvers that ensures repulsiveness. A resolution maneuver is repulsive if it increases the distance 
at the closest point of approach between two conflicting aircraft. The notion of repulsiveness is particularly 
relevant when a conflict between two aircraft can not be immediately solved. In this case, it is important that 
any resolution maneuver is in the appropriate direction, so that the distance at the closest point of approach 
increases even when both aircraft simultaneously maneuver. Similarly, the directions of the maneuvers are 
most important in a close encounter scenario such as when two aircraft have already lost minimum separation 
and must maneuver to recover separation. To eventually solve the conflict in these scenarios, aircraft have to 
maneuver in a way that incrementally improves the situation, which is measured by the distance at closest 
point of approach, hence the relevance of repulsiveness. 

In [5], a criterion for instantaneous maneuvers that guarantees repulsiveness is proposed. The next section 
presents the basic definitions of the criteria-based approach for instantaneous maneuvers provided in that 
work. 


III. Coordination for Instantaneous Maneuvers 


In this paper, vector variables are written in boldface and can be denoted by their components. For 
example, if u is a 2-dimensional (2-D) vector, thenu denotes the pair {ux, Uy). The two-dimensional Euclidean 
norm of the vector u is denoted by 


u = 


( 1 ) 


and the dot product of the 2-D vectors u and w is denoted 


U ■ W = {UxWx + UyWy). (2) 

Furthermore, 0 denotes the zero vector, i.e., 0 = (0, 0) and denotes the right perpendicular vector to u, 
i.e., 

U = ^x') • 

From these definitions, it can be easily proved that u ■ = 0. The function det is defined by 

det(u, w) = It • . (3) 

This paper considers pairwise resolution algorithms that return guidance maneuvers for aircraft. The 
terms ownship and intruder are used to distinguish between the aircraft for which the resolution maneuver 
is computed. These designations are relative in the sense that each aircraft will be from its point of view the 
ownship and the other aircraft will be the intruder. Without loss of generality, the development presented 
here takes the point of view of one of the aircraft, and that aircraft will be designated as the ownship. The 
algorithms discussed here use state-based information for the two aircraft as inputs, i.e., position and velocity 
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vectors that are elements of a Euclidean space. The current states of the ownship and intruder aircraft at 
time t = 0 are denoted by the following vectors: 

• So, Vq: Initial position and velocity of the ownship aircraft, respectively. 


• Si, -Vi'. Initial position and velocity of the intruder aircraft, respectively. 

Furthermore, it is assumed that the current ground speeds of the ownship and intruder aircraft are not zero, 
i.e., ||vo|| 7 ^ 0 and ||vi|| ^ 0. Therefore, Vq 7 ^ 0 and 7 ^ 0. 

In the airspace system, the separation requirement for two aircraft is specified by a minimum horizontal 
separation D (typically, Z? is 5 nautical miles). A loss of separation between two aircraft occurs when the 
distance between them is less than D. Thus, the ownship and intruder aircraft are in loss of separation if 
and only if it holds that 

||so - Sill < D. 

The separation requirement can be understood as an imaginary circle of diameter D around each aircraft, 
and a conflict between two aircraft as a future overlapping of these circles. In this paper, an alternative 
but equivalent view is considered where the intruder is surrounded by a circle, called the protected zone, 
of radius D. From this perspective, a conflict between the ownship and intruder aircraft is defined as the 
existence of a time t > 0 at which the ownship is in the interior of the intruder’s protected zone. In conflict 
detection algorithms, it is also required that t is within a specified lookahead time. However, since this 
work concerns resolution algorithms, a lookahead time is not considered. Formally, the ownship and intruder 
aircraft are in conflict along their current linear trajectories if and only if there exists t > 0 such that, at time 
t, separation is lost, i.e., ||(so + t Vo)-{si + t Vi)|| < D. Since {so + t Vq)- (s* + t v*) = (So-Si) +t (vq- v^), 
the mathematical expression that characterizes conflict can be defined on s = Sq — and v = Vo — v^, i.e., the 
relative position and velocity vectors, respectively, of the ownship with respect to the intruder. Therefore, 
conflict can be viewed as a Boolean condition on two vectors s and v rather than a condition on four vectors 
So, Vo, Si, and v^. This relative view simplifies the mathematical development presented in this paper. Thus, 
the Boolean condition conflict can be formally defined as follows. 

conf lict(s, v) = 3 t > 0 : ||s + t v|| < U. (4) 


In this paper, the relative position and velocity vectors, s and v, will commonly be used in place of So — s^ 
and Vo — Vi, respectively. 

As noted in Section II, a criterion for instantaneous maneuvers can be be analytically expressed by 
formulas involving the positions and velocity vectors of the two aircraft and a parameter that indicates 
directionality of the set of maneuvers, e.g., left/right, up/down, etc. An example of a criterion presented 
in [5] is horizontal criterion. This criterion guarantees that any resolution maneuver will independently 
and coordinatedly solve a conflict between the aircraft. The criterion is defined as follows. 


^ s • s — D‘^ 

horizontal_criterion(s, v, e)(v') = s • v' > e — det(s, v'). 


( 5 ) 


Here, the direction parameter e is either —1 or 1. Figure 1 illustrates the set of velocity vectors that satisfy 
the criterion horizontal criterion. The key property of this criterion is that it guarantees coordination 
when both aircraft use the same value of e. This value can be chosen implicitly without any communication 
between the aircraft. Given a choice of e, if each aircraft executes a maneuver that satisfies the criterion, 
then the combined result will both satisfy the criterion and remain conflict-free. 

A criterion related to repulsiveness is relevant to the work presented in this paper. A resolution maneuver 
is repulsive if it increases the distance at the closest point of approach between two conflicting aircraft. 
Formally, this is defined as a condition on s,v, which are the current relative position and velocity of the 
aircraft, and v', which is a relative velocity vector after a maneuver. Repuslive is formally is defined as 
follows. 


repulsive(s, v)(v') = (s • v < 0 and (tca(s, v') < 0 or ||s -|- tca(s, v) • v|| < ||s -|- tca(s, v') • v'||)) 
or (s • V > 0 and (v = 0 ^ s • v' > 0) and (v ^ 0 ^ s • v' > s • v)). 


( 6 ) 


This definition uses the function tea, which computes the time at closest point approach for converging 
aircraft with initial relative position s and relative velocity v, and is defined as follows. 


tca(s, v) 


s • V 

IUrl|2 • 


( 7 ) 
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There are two main conditions in Formula (6), the first being for the case where the aircraft are originally 
converging (getting closer together), i.e., when s • v < 0, and the second being for the case where they are 
diverging, i.e. when s • v > 0 . Given the current relative position s = Sq — and velocity v = Vq — v^, for 
the ownship aircraft with respect to the intruder, repulsive(s, v) is a condition on a relative velocity vector 
v' = v(, — Vi, where is a new velocity vector representing a possible maneuver for the ownship. It implies 
that the minimum distance achieved by the aircraft for positive times increases when the new velocity vector 
v(, is chosen by the ownship instead of the current vector Vq. The simplest visualization of repulsiveness 
is when two aircraft are in a head-on conflict scenario with a horizontal offset. In this case, repulsiveness 
just means that the new maneuver is incremental in the direction opposite the other aircraft, as indicated 
in Figure 2 . A criterion that ensures repulsiveness is defined as follows. 



Figure 2. Repulsive Maneuvers 

repulsive _criterion(s, V, e)(v') = 

s / 0 and v' 0 and e det (s, v) < 0 and e det (s, v') < 0 

and ( [s • V < 0 and edet(v', v) < 0 ] ^ ^ 

or [s • V > 0 and e det(v', v) < 0 and (v = 0 s • v' > 0) and (v 7^ 0 ^ s • v' > s • v) ] ). 

Just as in the definition of repulsion, repulsive criterion has two main conditions, the first being for 
the case where the aircraft are originally converging, i.e., when s • v < 0, and the second being for the case 
where they are diverging, i.e. when s • v > 0 . Also, the e parameter is similar to that used in the definition 
of horizontal_criterion above. It is equal to either —1 or 1 and indicates direction in the relative frame 
of reference. In general, the value for e that should be used in practice is the sign of det(v,s), which will be 
the same value when computed from the perspective of each aircraft. The following theorem, which states 
the coordination property of this criterion, has been formally proved in PVS. 

Theorem 1. If both aircraft maneuver instantaneously and each maneuver satisfies repulsive criterion, 
then the combined result is repulsive. That is, for all Sq, Vq, v(,, s^, v^, v' and e, if 

• repulsive_criterzon[so — Si,Vo — 'Vi,e)(y'^ — Vi) and 

• repulsive_criterion{si — Sq, — Vq, e)(v' — Vq) 

both hold, then repulsive{So — s^, Vq — Vi)(v(, — v() holds as well. 

The criterion repulsive criterion is fundamental to the definition of the criterion for kinematic ma- 
neuvers presented in Section IV and the coordination theorem of repulsive criterion implies the coor- 
dination of this more general kinematic criterion. 

IV. Coordination for Kinematic Maneuvers 

If there is a conflict between the ownship and the intruder, or if the aircraft have already lost separation, 
a resolution maneuver will be taken by one or both aircraft to resolve the conflict or to regain adequate 
separation. Henceforth, these maneuvers are modeled by kinematic trajectories. 
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A kinematic trajectory is represented as a sequence of velocities, along with a timestep value which 
specifies how long the aircraft have each velocity in the sequence. Formally, kinematic maneuvers are 
functions from the positive natural numbers N+ into 2-D velocity vectors. Let V : N+ — > be one 
such function. It is assumed that there is an associated time step r and that during the time interval 
[{k — 1) ■ T,k ■ t], where k G N+, the aircraft executing the maneuver has velocity V(k). Moreover, there is 
assumed to be a number N of time steps after which the aircraft follows its last velocity indefinitely. This 
piecewise linear trajectory can closely approximate a true trajectory, since every continuously differentiable 
function can be uniformly approximated on an interval by a piecewise linear function [8]. 

The ownship’s and the intruder’s kinematic maneuvers are denoted Vq and Vj, respectively. It is assumed 
for mathematical simplicity that the time step value is the same for the ownship as for the intruder. 

Example 2. If the ownship has initial position Sq = (0,0) and initial velocity Vq = (300,0) (the units do 
not matter) and makes a constant bank angle turn 90 degrees to the left by changing its heading by I degree 
per second, the corresponding maneuver Vq is given by 

Vo(k) = (300 cos(^),300 sin(^)), 

for k > 1, and the parameter N is 90. That is, after 90 incremental changes to its velocity, the ownship will 
continue indefinitely with velocity vector (0,300). 

Just as in the case of the current linear trajectories, where the relative velocity v can be used to compute 
the relative position at a future time t as s + tv, the notion of a relative velocity sequence is useful when 
studying the coordination of kinematic maneuvers. The relative velocity sequences Vq — v^, Vq — V^, and 
Vo- V, are defined by 

(Vo - Vi)(j) = Vo(j) - V*, 

(vo - Vi)(j) = Vo - V,(j), (9) 

(Vo-V,)(j) = Vo(j)-V.(j). 

The function pos_step, defined below, computes the sequence of positions so that pos _step(s, V, t)(j) 
is the position at the moment velocity V(j) is assumed. Thus, pos _step(s, t, V)(l) is equal to the initial 
position s. Further, pos step is defined recursively on j. 


pos _step(s, r, V)(j) = if j = I then s 

else pos _step(s, r, V)(j — 1) + tV (j — I) 
endif . 


(10) 


By using the function pos step, it is easy to compute the position at any future time t by first determining 
which time interval t falls into. This is accomplished through the function position, which computes the 
position at time t. 


position(s, r, V, N)(t) = let j = min(f loor( — ) + 1, N) in 


pos_step(s,r, V)(j) + {t - t ■ {j - I)) V(j). 


( 11 ) 


The concept of repulsive maneuvers is especially relevant for kinematic, piecewise linear maneuvers such 
as those represented by velocity sequences described above. As in the case of instantaneous maneuvers, a 
kinematic resolution maneuver is called repulsive if it increases the distance at the closest point of approach 
between the aircraft. It is defined as a condition on relative kinematic trajectories. Formally, a relative 
velocity sequence is repulsive if the distance between the aircraft at any future time is not less than the min- 
imum distance between the aircraft along their current trajectories. If the aircraft are currently converging, 
then this minimum distance is attained at the time of closest approach tca(s, v), and if they are currently 
diverging, then this minimum is attained at time 0. Repulsiveness for these kinematic maneuvers is formally 
defined as follows. 


repulsive_kin(s, v, r, V, N) = 

(s • V < 0 cuid V t : t > 0 
(s • V > 0 cuid V t : t > 0 


|position(s, T, V, A^)(t)|| > ||s -)- tca(s, v)v||) or 
||position(s,T, V, A^)(t)|| > ||s||). 


( 12 ) 
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In contrast to Formula (6), Formula (12) can not be algorithmically evaluated due to the universal quantifier. 
As it turns out, just as the instantaneous criterion repulsive criterion defined in Section III guaranteed 
coordinated repulsiveness, there is a criterion repulsive _kin_crit for these kinematic, piecewise linear 
relative velocity sequences that also guarantees coordinated repulsiveness when both aircraft maneuver. It 
is defined piecewise on each linear segment of the maneuver and, unlike the definition of repulsiveness given 
by Formula (12), it can be computed by an algorithm. The instantaneous criterion repulsive criterion 
is used in the definition of this new criterion. The new criterion repulsive_kin_crit checks incrementally 
whether each velocity V(j + 1) satisfies the criterion repulsive criterion with respect to the previous 
velocity V(j), at the position given by pos_step(s, r, V)(j + 1). It is formally defined as follows. 

repuls ivekincr it (s,v,r,7V, e)(V) = 

repulsive_criterion(s, V, e)(V(l)) and (13) 

\/ j : l<j<N repulsive _criterion(pos _step(s, r, V)(j + 1), V(j), e)(V(_) + 1)). 

It can be seen that any relative velocity sequence V that satisfies this condition will also be repulsive. In 
fact, the following theorem has been formally proved in PVS. 

Theorem 3 (Independence). repulsive_kin_crit{s^'v^T, N,e)(V) => repulsive_kin{s,v,T,'V^ N). 

Example 4. Consider the scenario in Figure 3. In this case, the initial positions of the two aircraft are 
So = (10,2), Si = (0,0) (units are nautical miles), and the initial velocities are Vq = (—500,0), = (500,0) 

(units are knots). In this scenario, the ownship executes an avoidance maneuver by changing its heading by 



Figure 3. Repulsive Relative Velocity Sequence 


3 degrees every 1 0 seconds for 1 minute and then continuing linearly. This sequence of velocity changes is 
represented by 

Vo(j) = (-500 cos(i^), 500 sin(i^)), 

the corresponding time step t is 10 seconds, or t = 0.0027 hours, and finally the corresponding value for N 
is 7. It can be seen that for these values, repulsive_kin crit(So — Si,Vo — Vi,T,N,€)(Vo — v^) holds for 
the relative velocity sequence Vq — when e = 1, which represents the right direction from the point of view 
of each aircraft, but does not hold when e = — 1, which represents the left direction. Also, it is clear from the 
definition of repulsiveness that repul sive_kin{so — s^, Vq — v^, r, Vq — v^, N) holds for this relative velocity 
sequence as well. 

The most important property of the criterion repulsive kin crit is that, in addition to guaranteeing 
repulsiveness when only one aircraft maneuvers, it also guarantees repulsiveness when both aircraft maneuver, 
which means that it is coordinated with respect to repulsiveness. The following theorem, which states the 
main coordination property for this criterion, has been formally proved in PVS. 

Theorem 5 (Coordination). If the conditions 

• repulsive_kin crit{So — s^, Vq — v^, r, N, e)(Vo — v^) 

• repulsive kzn crztisi — Sq, — Vq, t, N, e)(Vi — Vq) 
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both hold, then relative velocity sequence Vq — is repulsive. That is, the condition 


repul sive_kin{So - s^, - v*, r, V,, - V^, N) 


holds. 

Example 6. Consider the same scenario that was given in Figure 3, but in the case where both aircraft 
execute similar maneuvers. As above, the initial positions of the two aircraft are Sq = (10,2), = (0,0), 

and the initial velocities are Vq = (—500,0), = (500,0), and the time step is t = 0.0027 hours (10 

seconds). In this scenario, each aircraft executes an avoidance maneuver by changing its heading to the right 



Figure 4. Repulsive Coordinated Relative Velocity Sequence 

by 3 degrees every 10 seconds for 1 minute and then continuing linearly. This sequences of velocity changes 
are represented by 

Vo(j) = (-500 cos(^), 500 sin(^)) and Vo{j) = (500 cos(^), -500 sin(i^)). 

For these values, repulszve_kin_crit[So ~ Si,Vo — 'Vi,T, N, e)(Vo ~ v^) and repulsive kin critisi — 
So ) Vi — Vo, T, N, e)(Vi — Vo) both hold when e = 1, which represents the right direction from the point of view 
of each aircraft, but do not hold when e = —1, which represents the left direction. Also, it is clear from the 
definition of repulsiveness that repul sive_kin{So — Si, Vq — Vi, r, Vq — Vi, N) holds for this relative velocity 
sequence as well, and thus these two maneuvers exhibit coordination. 

Theorem 5 requires that both aircraft choose the same value for e. However, this is quite easy even without 
explicit communication. In fact, e can be simply chosen by the ownship to be the sign of det(vo — Vi,So — Si). 
The intruder will similarly choose e to be the sign of det(vi — Vo,Si — So), which is exactly the same value 
since 

det(Vo - Vi, So - Si) = det(vi - v„,Si - s^). 

In general, except in the case where the aircraft are on perfect straight line collision trajectories, this choice of 
e is the only choice possible while still satisfying the criterion repulsive _kin_crit. Indeed, the condition 
inside the definition of repulsive kin crit requires, by the definition of repulsive criterion, that 
e det(so — Si, Vo — Vi) < 0. Unless det(so — Si, Vq — Vi) =0, which is precisely when the aircraft will eventually 
collide, this is only possible when e is the sign of det(vo — Vi, Sq — Si). 

Another important note regarding Theorem 5 is that Figure 4 is just a simple example of coordination 
where it is clear what each aircraft should do. More complicated encounter geometries exist where it is 
unclear at first glance which direction each aircraft should maneuver to incrementally improve the situation. 
Theorem 5 guarantees that even in these complicated scenarios, if each aircraft chooses a maneuver that 
satisfies the criterion repulsive _kin_crit, the combined result will still exhibit coordination when both 
aircraft maneuver. The theorem holds in all possible geometries. 

Theorem 5 guarantees implicit coordination in the sense that the aircraft do not need to communicate 
anything other than their original positions and velocities for the kinematic maneuvers to exhibit coordina- 
tion. Implicit coordination is sometimes viewed as unnecessary when communication channels already exist 
in a concept of operations. However, it should be noted that implicit coordination such as that guaranteed 
by this theorem can provide an extra layer of safety even when such communication is possible. This is 
because it can guarantee coordination even when communication fails or messages are dropped, as long as 
the aircraft have accurate estimates of each other’s current positions and velocities. 
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V. An Interesting Example 


Recall that the kinematic criterion defined in Section IV is defined by requiring each successive velocity 
in the relative velocity sequence V to satisfy the instantaneous repulsive criterion repulsive criterion. 
It may seem obvious that requiring each incremental change in the velocity sequence to satisfy a safety 
property like repulsiveness at each incremental step is enough to ensure coordination even when both aircraft 
maneuver. However, this is not always the case. An example is given below in which the aircraft are originally 
diverging, and the maneuver that each aircraft executes is incrementally diverging from the other aircraft’s 
current linear trajectory, but if they both maneuver, the combination of the maneuvers puts the aircraft in 
conflict. This is similar to a phenomenon with instantaneous maneuvers that, in the case where the aircraft 
are originally diverging, allows each aircraft to turn toward the other aircraft, thus losing coordination but 
still maintaining safety in the case where only one of them maneuvers. That example for instantaneous 
maneuvers was presented in [5]. 

The example presented below shows that it is not enough to design the instantaneous repulsive criterion 
repulsive criterion, defined in Section III, to simply ensure divergence in the case where the aircraft 
are initially diverging. The authors initially defined the kinematic criterion repulsive kin crit using 
that condition, namely that in the case where the states were diverging, each successive velocity in the 
maneuver was only required to be divergent. The process of trying to formally prove the coordination 
properties of this kinematic criterion failed, leading the authors to realize that this definition of the criterion 
was too liberal in the diverging case. A more conservative version of the instantaneous repulsive criterion 
repulsive criterion was needed to ensure the coordination of the kinematic criterion. 

In this example, the aircraft have the following initial states: Sq = (—10,0), = (—300,0), = (10,0), 

and Vi = (300,0). The units for positions are nautical miles (nm) and the units for velocities are knots. 
The two aircraft are initially separated by 20 nm and are heading in exactly opposite directions. Thus, they 
are diverging. The initial states are shown in Figure 5. In this figure, the ownship is shown in blue and the 
intruder in green. 



Figure 5. Initial States Diverging 


Each aircraft in this example executes a turn with a constant bank angle of 25 degrees, the ownship to 
its right and the intruder to its left. This results in turns with heading changes of approximately 1.7 degrees 
per second. Each aircraft executes the turn until its track angle has changed 165 degrees from its initial 
track angle, at which point it continues linearly. These maneuvers can be seen in Eigure 6. Each incremental 



Figure 6. Divergent But Not Coordinated Maneuvers 


velocity change by the ownship along its maneuver maintains divergence from the intruder, assuming that 
the intruder continues its originally linear trajectory without turning. The same holds for the intruder if 
the ownship continues its original trajectory. However, if they both maneuvered at the same time, the 
aircraft would collide at approximately 230.5 seconds after the initial states. This shows that for the safety 
that coordination ensures, the definition of the instantaneous repulsive criterion must restrict maneuvers in 
the initially-divergent case more than just requiring continued divergence. This is the reason for the more 
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elaborate conditions in Formula 6 in Section III in the divergence case, i.e., when s • v > 0, which require 
edet(v', v) < 0 and (v = 0 s • v' > 0) and (v 7^ 0 ^ s • v' > s • v). 

VI. Conclusion 

This paper extends previous work [4,5] on coordination for instantaneous maneuvers. That work focused 
mostly on conflict resolution, where distances between the aircraft often make the instantaneous maneuver 
assumption a reasonable approximation. However, for cases where the time to conflict is small, or alterna- 
tively for recovery from loss of separation, the piecewise linear kinematic model used in this paper provides 
a better approximation of actual aircraft trajectories. This model is also better at determining whether 
coordinated behavior will actually be observed by aircraft executing those maneuvers. 

This paper presents the notion of a criterion for kinematic, piecewise linear maneuvers that guarantees 
independence and implicit coordination with respect to repulsiveness. Implicit coordination can be useful for 
ensuring safe interplay of maneuvers between aircraft, because aircraft do not need to communicate anything 
other than their original positions and velocities for the kinematic maneuvers to exhibit coordination. It is 
also important to note that implicit coordination can enhance safety even when aircraft communicate more 
information about their intent. In that case, it can add an extra layer of safety, because it can guarantee 
coordination even when communication fails or messages are dropped, as long as the aircraft have accurate 
estimates of each other’s current positions and velocities. 

The primary motivation behind the further development of the concept of implicit coordination is that 
it enhances safety features key to any separation assurance system. Thus, the theorems presented here 
have been proved correct in an interactive theorem prover, which is a system that allows safety properties 
to be stated and formally proved. The use of an interactive theorem prover is justified by the paramount 
importance of safety in new air traffic management systems. 
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